Splunk Search

regex matched data only

Path Finder

I have a regex which looks for any event that has the repid=XXXX where XXXX is some number

"mysearch | rex repid=(?<REP_ID>\d+)"

I need to display data that only matches that criteria. for example none of these should be shown:

repid
or 
repid=
or 
repid%s20=
or
repid-1245
Tags (2)
1 Solution

Splunk Employee
Splunk Employee

Your example is not valid, please avoid the confusion between :

  • the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

  • the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

View solution in original post

Splunk Employee
Splunk Employee

Your example is not valid, please avoid the confusion between :

  • the command "regex" that is used as a filter, and does not extract anything.

that would look like :

mysearch repid | regex _raw="repid=\d+"

or if the field is already extracted

mysearch repid | regex repid="\d+"

  • the command "rex" that is used to define field extractions not to filter

mysearch repid | rex "repid=(?<REP_ID>\d+)"

here is a complex way to do it, but not really worth it

mysearch repid | rex "repid=(?<REP_ID>\d+)" | fillnull REP_ID value="was not found" | where REP_ID!="was not found"

View solution in original post

Path Finder

got that to by using (?i) in regex _raw="(?i)repid=\d+"

0 Karma

Path Finder

awesome! thanks for the help. is it possible to make the repid in regex _raw="repid=\d+" case insensitive? the reason is that there might be some cases of RepID or repiD, etc.

0 Karma